Three MaxKB authorization bugs let workspace users reach MCP tools and credentials they were denied

NVD·medium signalXBlueskyLinkedInCopy link

Alongside the 10.0 shell bug, NVD published three MaxKB MCP authorization flaws on 2026-09-21. CVE-2026-77516 (5.4, 2.0.0 through 2.9.2) lets a lowest-role member denied a tool bind its identifier through tool_ids, skill_tool_ids or mcp_tool_ids and run it through the agent or workflow dispatch path, which never reapplies the per-tool grant and decrypts server-side init_params. CVE-2026-77518 (5.0) lets a normal user fetch another user's MCP tool through the tool-detail route, which skips the list route's per-resource check and returns Tool.code containing MCP server config and headers. CVE-2026-77519 (5.4) lets an expired non-permanent application key initialize the /chat/api/mcp endpoint and call tools, because that path checks only the secret and active flag.